fix(protocol): preserve initial login packets

[zoeyrose]

Summary

Correct initial-login item ordering and notification delay decoding, and expose existing notification/mapstats command constants to the embedded Python module.

Implementation / behavior

Keep item updates behind their initial introduction, read the notification delay once before clamping, and export generated command identifiers without changing the wire contract. Focused regressions cover the production paths and malformed input.

Validation

Validation results will be recorded after focused before/after regressions, pinned container builds and tests, and independent whole-diff review.

Limitations / follow-up

Offline validation does not complete real gameplay qualification. Runtime owner atrinik/atrinik#604 repeats that qualification after maintainer merge. Authored content remains a separate delivery.

Closes #550

Final validation and review

The final commit is 0058d6a904386c86b3f06844c66d9273baca6f9e.

• The saved-player regression exercises normal inventory merges and insertion while logging in, after entering playing state, between PLAYER and the own-inventory snapshot, and after that snapshot. A different-container snapshot does not establish the initial inventory. The own snapshot's target and item contents are checked.
• The real sign producer generates a fresh packet that is explicitly replayed into the actual client notification handler. Delay boundary and genuine truncation cases pass. The actual embedded Python module exports CLIENT_CMD_NOTIFICATION=26 and CLIENT_CMD_MAPSTATS=12.
• Pinned CPU builds pass: server 54 tests, client 50 tests, libatrinik 18 tests, and server sanitizers 55 tests. The 16 GPU client tests are explicitly skipped in this offline CPU lane.
• Optimized Release fixtures and the full client Release suite pass. The compound fixture uses function and data sections so the optimized linker can discard unrelated handlers; its checks remain active under NDEBUG. This fixes the initially observed Release-only test-link failure.
• Both instrumented module suites pass. Coverage reports use the workflow-pinned Classic CI image and gcovr 7.2: server line coverage 62.9%, client 29.4%. Before/after hashes prove that reporting preserved all instrumented data and CMake caches.
• Protocol generation and tests, dependency checks, server/client/repository Python tooling, imported history verification, changed-line clang-format and git diff --check pass.
• GitHub Classic validation, CodeQL validation and Conventional PR title pass, including native Windows tests and trusted GPU-renderer coverage.
• Independent whole-diff source review and final evidence audit found no remaining actionable local findings.

Earlier diagnostic runs exposed the intended regressions and two subsequently fixed test compilation issues. Failed tooling invocations and reporting attempts remain retained as failures; they are not counted as passing acceptance runs. A historical local formatter resource-planning violation is disclosed in the private delivery record; all final acceptance uses the subsequently reviewed container composition.

Real GPU/audio/gameplay qualification remains with atrinik/atrinik#604 after maintainer merge and verified artifact refresh. The separately owned authored-content correction is atrinik/content#264. This PR does not modify authored content, change wire IDs, or claim live gameplay qualification.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
server/src/socket/item.c	71.42%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!